CWE-639 · Authorization Bypass Through User-Controlled Key (page 22)
Page 22 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12447 | Medium | 4.3 | 2024-12-14 | The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-c… |
CVE-2024-12309 | Medium | 5.3 | 2024-12-13 | The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2024-11275 | Medium | 4.3 | 2024-12-13 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a… |
CVE-2024-11181 | Medium | 4.3 | 2024-12-12 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via… |
CVE-2024-12059 | Medium | 4.3 | 2024-12-12 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via th… |
CVE-2024-12483 | Low | 3.7 | 2024-12-12 | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User… |
CVE-2024-12306 | Medium | 4.3 | 2024-12-09 | Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of s… |
CVE-2024-12305 | Medium | 4.3 | 2024-12-09 | An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A m… |
CVE-2024-10692 | Medium | 4.3 | 2024-12-06 | The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2024-10689 | Medium | 4.3 | 2024-12-06 | The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4… |
CVE-2024-10777 | Medium | 4.3 | 2024-12-05 | The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' short… |
CVE-2024-10787 | Medium | 4.3 | 2024-12-04 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'element… |
CVE-2024-12099 | Medium | 4.3 | 2024-12-04 | The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0… |
CVE-2024-42422 | High | 8.3 | 2024-12-03 | Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated attacker with remote access… |
CVE-2024-12062 | Medium | 4.3 | 2024-12-03 | The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharity_eleme… |
CVE-2024-53617 | Medium | 4.8 | 2024-12-02 | A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the ad… |
CVE-2024-38827 | Medium | 4.8 | 2024-12-02 | The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not workin… |
CVE-2024-10798 | Medium | 4.3 | 2024-11-28 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr… |
CVE-2024-10780 | Medium | 4.3 | 2024-11-28 | The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'nares… |
CVE-2024-10670 | Medium | 4.3 | 2024-11-28 | The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_… |
CVE-2024-10868 | Medium | 4.3 | 2024-11-23 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1… |
CVE-2024-50395 | High | 8.8 | 2024-11-22 | An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could all… |
CVE-2024-10666 | Medium | 4.3 | 2024-11-22 | The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via… |
CVE-2024-10796 | Medium | 4.3 | 2024-11-21 | The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifs… |
CVE-2024-10782 | Medium | 4.3 | 2024-11-21 | The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-templ… |
CVE-2024-10696 | Medium | 4.3 | 2024-11-21 | The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress… |
CVE-2024-10671 | Medium | 4.3 | 2024-11-21 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and incl… |
CVE-2024-48899 | Medium | 4.3 | 2024-11-20 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended… |
CVE-2024-10855 | High | 8.1 | 2024-11-20 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to… |
CVE-2024-11318 | High | 7.5 | 2024-11-18 | An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote atta… |
CVE-2024-10795 | Medium | 4.3 | 2024-11-16 | The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortco… |
CVE-2024-52511 | Medium | 6.3 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly ins… |
CVE-2024-52507 | Low | 3.5 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and t… |
CVE-2024-50651 | Medium | 6.5 | 2024-11-15 | java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID… |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2024-10794 | Medium | 4.3 | 2024-11-13 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the… |
CVE-2024-10174 | High | 7.3 | 2024-11-13 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direc… |
CVE-2024-10778 | Medium | 4.3 | 2024-11-13 | The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via… |
CVE-2021-27700 | High | 7.6 | 2024-11-12 | SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dash… |
CVE-2023-47543 | Medium | 5.4 | 2024-11-12 | An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacke… |
CVE-2024-10695 | Medium | 4.3 | 2024-11-12 | The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcod… |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-10688 | Medium | 4.3 | 2024-11-09 | The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2 via the 'attesa-template' shortcode due… |
CVE-2024-10770 | Medium | 4.3 | 2024-11-09 | The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode du… |
CVE-2024-10669 | Medium | 4.3 | 2024-11-09 | The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2024-10667 | Medium | 4.3 | 2024-11-09 | The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to… |
CVE-2024-10693 | Medium | 4.3 | 2024-11-09 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to… |
CVE-2024-9262 | Medium | 6.5 | 2024-11-09 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a… |
CVE-2024-10779 | Medium | 5.3 | 2024-11-09 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' s… |
CVE-2024-52313 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user… |
CVE-2024-43438 | High | 7.5 | 2024-11-07 | A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned… |
CVE-2024-51559 | Medium | 6.5 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vu… |
CVE-2024-48217 | High | 8.8 | 2024-11-01 | An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation. |
CVE-2024-37277 | High | 7.5 | 2024-11-01 | Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This iss… |
CVE-2024-10654 | Medium | 5.3 | 2024-11-01 | A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-51066 | High | 7.5 | 2024-10-31 | An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 allows unauthorized ac… |
CVE-2024-9700 | Medium | 5.3 | 2024-10-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2024-10452 | Low | 2.2 | 2024-10-29 | Organization admins can delete pending invites created in an organization they are not part of. |
CVE-2024-7474 | High | 8.1 | 2024-10-29 | In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating… |
CVE-2024-7473 | Medium | 6.5 | 2024-10-29 | An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an aut… |
CVE-2024-50483 | Critical | 9.8 | 2024-10-28 | Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a thr… |
CVE-2024-10439 | Medium | 5.3 | 2024-10-28 | The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific paramete… |
CVE-2024-9637 | High | 8.8 | 2024-10-26 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includi… |
CVE-2024-10121 | High | 7.3 | 2024-10-18 | A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handl… |
CVE-2024-9263 | Critical | 9.8 | 2024-10-17 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalati… |
CVE-2024-9862 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. Thi… |
CVE-2024-9215 | High | 8.8 | 2024-10-17 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Refe… |
CVE-2023-32189 | Medium | 5.9 | 2024-10-16 | Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys |
CVE-2024-8040 | High | 7.7 | 2024-10-16 | An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker… |
CVE-2023-7286 | Medium | 6.5 | 2024-10-16 | The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possibl… |
CVE-2024-49388 | Critical | 9.1 | 2024-10-15 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 3… |
CVE-2024-9687 | High | 8.8 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validat… |
CVE-2024-46528 | Medium | 4.3 | 2024-10-14 | An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3… |
CVE-2024-47495 | Medium | 6.7 | 2024-10-11 | An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device… |
CVE-2024-7041 | Medium | 6.5 | 2024-10-09 | An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0… |
CVE-2024-9554 | Low | 3.7 | 2024-10-06 | A vulnerability classified as problematic was found in Sovell Smart Canteen System up to 3.0.7303.30513. Affected by this vulnerability is the function Check_E… |
CVE-2024-47316 | Medium | 4.3 | 2024-10-05 | Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking sys… |
CVE-2024-47657 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploi… |
CVE-2024-20513 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2021-37577 | Medium | 6.8 | 2024-10-01 | Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3… |
CVE-2024-9298 | Medium | 4.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |
CVE-2024-39319 | Medium | 5.3 | 2024-09-26 | aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, a… |
CVE-2024-8290 | High | 8.8 | 2024-09-25 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2024-8485 | Critical | 9.8 | 2024-09-25 | The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the… |
CVE-2024-8791 | Critical | 9.8 | 2024-09-24 | The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all vers… |
CVE-2024-45806 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, pote… |
CVE-2024-45614 | Medium | 5.4 | 2024-09-19 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) b… |
CVE-2024-46982 | High | 7.5 | 2024-09-17 | Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic s… |
CVE-2024-45606 | High | 7.1 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and pro… |
CVE-2024-45605 | Medium | 6.5 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary u… |
CVE-2024-47047 | High | 7.5 | 2024-09-17 | An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure… |
CVE-2024-6685 | Low | 3.1 | 2024-09-16 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group… |
CVE-2024-46937 | High | 7.5 | 2024-09-16 | An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x t… |
CVE-2022-3459 | Medium | 5.3 | 2024-09-14 | The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin n… |
CVE-2024-6087 | Medium | 6.5 | 2024-09-13 | An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to… |
CVE-2024-25270 | Medium | 4.3 | 2024-09-12 | An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID paramete… |
CVE-2024-3306 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-3305 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. … |
CVE-2024-27113 | Critical | 9.8 | 2024-09-11 | An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is e… |
CVE-2024-45786 | Medium | 6.5 | 2024-09-11 | This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could… |